Apparently
You don’t need a password. Posterous fail.
-----------------------------------------------------------------------
Someone posted this to Posterous using my email address, presumably because of a comment I left on Hacker News: http://news.ycombinator.com/item?id=1439370 . Incidentally, this was also posted to Twitter and Facebook.
It's possible to forge headers in certain circumstances. It's not easy. And this is the first time this has happened. (Actually it is easy to forge headers, but Posterous does some extra checks to make sure you really are you. Apparently, those checks didn't work well enough here.)
---
UPDATE Sachin, cofounder of Posterous, responded to the hole here: [http://news.ycombinator.com/item?id=1443139](http://news.ycombinator.com/item?id=1443139). Apparently there's even more security to prevent spoofing than I thought.
You should follow me on twitter here
